# Governed Execution Errors and Troubleshooting

URL: https://docs.nexart.io/docs/governed-execution/errors

Expected results for valid and adversarial governed graphs, how reason codes differ from issue codes and HTTP status, and why a private record returns not found.

## Positive and negative test matrix

Each row was reproduced with `@nexart/governed-execution@0.4.2`.

| Condition | Expected result |
| --- | --- |
| Valid cyclic static topology and acyclic concrete execution | Accepted |
| Static self-edge without concrete self-parent | Accepted |
| Legal actual-parent subset | Accepted |
| Omitted topology | Accepted with topologyValidation: not-supplied |
| Forbidden concrete edge | TOPOLOGY_ERROR / ILLEGAL_EXECUTED_EDGE |
| Unresolvable contraction cycle | TOPOLOGY_ERROR / UNRESOLVABLE_CONTRACTION_CYCLE |
| Concrete cycle | CAUSAL_ERROR |
| Concrete self-parent | CAUSAL_ERROR |
| Dangling or forward parent | CAUSAL_ERROR |
| Malformed stateHash | SCHEMA_ERROR |
| Unknown concrete node with supplied topology | TOPOLOGY_ERROR / UNKNOWN_NODE (sealing throws) |

A tampered CER also reports `certificateHash mismatch` because the protected projection changed.

## Codes, issues, HTTP status and verdict

- Top-level reason code: one of `OK`, `SCHEMA_ERROR`, `CAUSAL_ERROR`, `TOPOLOGY_ERROR`, `CERTIFICATE_HASH_MISMATCH`, `CANONICALIZATION_ERROR`, `RESOURCE_ERROR`.
- Detailed SDK issue codes: strings in `errors[]`, such as `ILLEGAL_EXECUTED_EDGE`.
- HTTP transport status: 200 means the call completed; 401 means a missing or invalid key on `/api/attest`.
- Verification verdict: `status` and `classification` in the response body.

## Attestation failures

`POST /api/attest` returns HTTP 400 with the body below for SDK rejections, 409 `EXECUTION_MUTATION_DETECTED` when the same `bundleId` arrives with a different hash, and 400 `READABLE_FIELDS_UNSUPPORTED` if `X-NexArt-Readable-Fields` is sent. Full table: failure responses.

```
{
  "error": "INVALID_BUNDLE",
  "reasonCode": "<SDK_CODE>",
  "details": ["<SDK_ERROR>"]
}
```

## "My attestation succeeded, but the public URL says Record Not Found"

- Attestation does not publish. Governed records default to `hidden`; hidden, private, deleted and missing records all return the same 404.
- `verificationUrl` is formatted by the Node, not checked. The `verify.nexart.io` backend is outside the audited Node source.
- Verify the complete CER locally or through `POST /v1/cer/verify`.
- There is no governed public-reseal workflow. Node 0.30.1 supports an authenticated visibility transition that does not change the protected certificate hash. This source audit does not establish the external verifier&#x27;s storage or lookup implementation.
- Do not make a record public merely to remove the 404.